Comment

Not entirely

Firstly you don’t “generate hashes until there is a match”. You can generate hashes until the end of the universe and you’ll still have only a fraction of all possible hashes.

What typically is used are large lookup tables with hashes from known passwords. You can then take that table, take a hash you got, and look it up.

So firstly, hashes should be salted, and if salted correctly, it’s already extremely much harder to use because these tables no longer work. There are few more things you can do but that pretty much is a hard wall already.

The problem is that many corporate systems out there have horrible security. They either use a hash that has been known to be broken since a long time ago (hello LinkedIn), don’t use salting (hello linkediiiiiinn), or don’t use hashing at all.

It’s because of idiots like these that there are so many accounts with password tables out there

What to do?

Use password managers. Now all your site’s have different, safe passwords and you only need to know one. Use 2FA where possible and supported

source

Sort:hotnew top

moseschrute@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Can you also use a list of common passwords and a ruleset you apply to those common passwords, and then hash(applyRule(commonPassword)) == compromised hash ?

source
- phoenixz@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
  That’d basically how these hash tables work, they have the account and hash and known password so you can do rapid lookups
  
  source
- AA5B@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  I’m not entirely sure what you mean but my password manager alerts when the hash of one of my passwords matches one from a dark web data dump, and prompts me to replace it with a newly generated one.
  
  I’m sure it’s not a unique feature
  
  Admittedly I do have a few bad password, a combination of I don’t see how I could care (like a Reddit alt account) and sites that break the password change automation (yeah I’m lazy)
  
  source
  - moseschrute@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    I wonder how that works. The point of password hashing is to uniquely scramble your password. So userOneHash(“password”) should give a different output than userTwoHash(“password”) even if they use the same password. So your password manager shouldn’t really be able to generate the same password hash since an infinite number of hashes can be generated from the same password.
    
    source
    phoenixz@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
    A hash is just a mathematical algorithm that generates a somewhat unique number from any input, and usually in such a way that the tiniest difference generates a completely different hash.
    
    I can put a single letter in a hash, I can put the entire Bible in a hash, I can put the entire universe in a hash, the output is always the same amount of bytes.
    
    For example, if I have a hash algorithm that generates a two letter hash, a-z, then the input “Lemmy” could give me “WK” while “Lemmx” (literally one bit difference in binary) could give me “AV”. If I put the Bible in there, I could get out “XX”, for example.
    
    The same input always generates the same output, and another important tidbit: hashing is always one way, you can’t do it in reverse.
    
    Also important, as you probably already noticed: the hash contains (usually, but not necessarily) much less information than the original input. This means that at some point, two different inputs can generate the same output, that’s called a collision.
    
    If the entire world would use the same hash all the time, and users would all use the same password for every website, then all the hashes for all the websites would be the same.
    
    Now, humans are humans, and most humans use a fairly limited set of passwords. Sole people try to be ingentilent by replacing “s” with “5”, thinking that computers won’t get that.
    
    Then, somebody started compiling a list of all known passwords with all variations and put them in a table. Then they went over each password, and hashed it with a bunch of well known hashing algorithms. Those tables, called rainbow tables iirc, are super easy and fast lookup tables if you have a hash and want to see what password it could have been.
    
    Now what can websites do to protect against this? They can “salt” the password by prefixing then with a random text string only known to the website. If I download the database of that website, all the hashes will now be different and I won’t be able to do the lookup anymore. Better even would be to also include the user id in there, making it even harder to decipher.
    
    What can users do? Don’t use those “Kn0w13DgE” passwords, use a random string of characters. Use unique passwords for each site. Use a password manager which will do both for you so you won’t have to remember anything
    
    source